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in the claims: 

1. a lock-step synchronism fault-tolerant computer 
system including a plurality of computing modules having 
a processor and a memory in which each computing module 
processes the same instruction string in synchronization 
with each other , wherein 

when detecting disagreement in a state of access 
to an external bus among said processors in each said 
computing module, if no fault is detected in the system 
including each said computing module , processing of 
resuming operation in synchronization is executed with 
respect to each said computing module after generating 
an interruption to all of said processors to execute 
delay adjustment for making a state of instruction 
execution among said computing modules be coincident. 

2 . The fault-tolerant computer system as set forth 
in claim 1, further comprising: 

a fault detector which monitors existence/non- 
existence of a fault in the system; 

a bus monitor which monitors a state of access of 
each said processor in each said computing module to the 
external bus; 

interruption control means for, in a case where 
said bus monitor detects lack of synchronization in a 
state of access of each said processor in each said 



computing module to the external bus, when said fault 
detector detects no fault, generating an interruption 
for notifying the detection result to each said 
processor; 

inter-system communication control means 
connected to each said computing module for notifying a 
state of instruction execution among said processors in 
each said computing module, and 

synchronization control means connected to each 
said computing module for generating a reset signal for 
resuming operation of all said computing modules in 
synchronization after conducing delay adjustment for 
making a state of instruction execution in each said 
computing module be coincident. 

3. The fault-tolerant computer system as set forth 

in claim 2, wherein 

each of all said processors includes an 
instructions number counter for counting the number of 
executed instructions in the processor, said 
instructions number counter fails to operate when said 
processors receive an interruption from said 
interruption control means and shift to a processor 
management mode for re-synchronization; 

each said processor compares a value of its own 
instructions number counter with a value of instructions 
number counter received from each corresponding 
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processor in other computing modules; 

said computing module, which does not include the 
instructions number counter indicating the largest value 
among all of the counters, conducts delay adjustment of 
executing instructions until the instructions number 
counter value coincides with the largest instructions 
number counter value and when the values coincide, sends 
a notification to the computing module which includes 
the instructions number counter indicating the largest 
value, and 

said computing module, which includes the 
instructions number counter indicating the largest value, 
waits for receiving a notification from all the other 
computing modules and when receiving all the 
notifications, instructs said synchronization control 
means to generate a reset signal for causing all the 
computing modules to resume operation in synchronization 
with each other. 

4. The fault-tolerant computer system as set forth 

in claim 3, wherein 

in delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value, 

said processor is set at a step execution mode 
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for shifting to said processor management mode after 
executing one instruction , and 

said processor repeats the processing of the step 
execution mode until the instructions number counter 
value coincides with the largest instructions number 
counter value. 

5. The fault-tolerant computer system as set forth 

in claim 2, wherein 

each of all said processors received an 
interruption from said interruption control means shifts 
to a processor management mode for re-synchronization 
processing in which an instructions number counter for 
counting the number of executed instructions in the 
processor fails to operate and a program counter value 
is saved and stored; 

each said processor reads an instructions number 
counter value of each processor and said saved program 
counter value and transmits the values to all other said 
computing modules; 

each said processor compares the instructions 
number counter value with an instructions number counter 
value received from each processor in other computing 
modules ; 

said computing module whose said instructions 
number counter value is not the largest conducts delay 
adjustment of executing instructions until the 



instructions number counter value coincides with the 
largest instructions number counter value and when the 
values coincide, sends a notification to the computing 
module which includes the instructions number counter 
indicating the largest value , and 

said computing module which includes the 
instructions number counter indicating the largest value 
waits for receiving a notification from all the other 
computing modules receiving a notification from all the 
other computing modules and when receiving all the 
notifications, instructs said synchronization control 
means to generate a reset signal for causing all the 
computing modules to resume operation in synchronization 
with each other. 

6 . The fault-tolerant computer system as set forth 

in claim 5, wherein 

in delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value, 

said processor is set at a break point 
designation execution mode for shifting to said 
processor management mode after executing up to an 
instruction at a specific position in a designated 
instruction string; 



as said specific position in the instruction 
string, an instruction position indicated by the program 
counter value received from said computing module which 
includes the instructions number counter indicating the 
largest is designated to, and 

after executing the instruction string up to said 
specific position in a designated instruction string 
said processor is shifted to the processor management 
mode . 

7 . The fault-tolerant computer system as set forth 

in claim 3, wherein 

after reading a program execution state, said 
computing module, which includes the instructions number 
counter indicating the largest, waits for said 
notification from other computing modules; 

after executing the delay adjustment processing, 
all the other computing modules, which does not include 
the instructions number counter indicating the largest 
value, read a program execution state and transmit the 
program execution state together with a notification of 
completion of the delay adjustment processing to the 
computing module which includes the instructions number 
counter indicating the largest, and 

the computing module which includes the 
instructions number counter indicating the largest 
compares program execution states of all the computing 



modules and when all coincide with each other, instructs 
on generation of the reset signal for resuming 
synchronization operation and when a computing module 
whose program execution state is not coincident is 
detected, instructs on the generation of the reset 
signal for resuming operation in synchronization after 
executing processing of cutting off and invalidating the 
computing module. 

8. The fault-tolerant computer system as set forth 
in claim 2, wherein 

a plurality of pairs of said fault detector, said 
bus monitor, said interruption control means, said 
inter-system communication control means and said 
synchronization control means are provided. 

9. A re-synchronization method in a lock-step system 
fault-tolerant computer system including a plurality of 
computing modules having a processor and a memory in 
which each computing module processes the same 
instruction string in synchronization with each other, 
comprising the steps of: 

when detecting disagreement in a state of access 
to an external bus among said processors in each said 
computing module, if no fault is detected in the system 
including each said computing module, generating an 
interruption to all of said processors, and 
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after executing delay adjustment for making an 
instruction execution state be coincident among said 
computing modules, executing processing of resuming 
operation in synchronization with respect to each said 
computing module. 

10. The re-synchronization method of a fault-tolerant 
computer system as set forth in claim 9, further 
comprising the steps of: 

monitoring existence/non-existence of a fault in 
the system; 

monitoring a state of access of each said 
processor in each said computing module to the external 
bus; 

when detecting disagreement in a state of access 
of each said processor in each said computing module to 
the external bus, if no fault is detected, generating an 
interruption for notifying the detection result to all 
of said processors, and 

after executing the delay adjustment for making a 
state of instruction execution be coincident among said 
computing modules, generating a reset signal for 
executing processing of resuming operation in 
synchronization of all said computing modules. 

11. The re-synchronization method as set forth in 
claim 10, further comprising the steps of: 
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each of all said processors received said 
interruption shifting to a processor management mode for 
5 re-synchronization processing in which an instructions 

number counter for counting the number of executed 
instructions in the processor fails to operate; 

each said processor comparing the read 
instructions number counter value with an instructions 

10 number counter value received from each processor in 

other computing modules; 

said computing module , which does not include the 
instructions number counter indicating the largest value 
among all of the counters, executing the delay 

15 adjustment of executing instructions until the 

instructions number counter value coincides with the 
largest instructions number counter value and when the 
values coincide, sending a notification to the computing 
module which includes the instructions number counter 

20 indicating the largest value, and 

said computing module, which includes the 
instructions number counter indicating the largest value, 
waiting for receiving a notification from all the other 
computing modules and when receiving all the 

25 notifications, generating the reset signal for causing 

all the computing modules to resume operation in 
synchronization with each other. 

12. The re-synchronization method as set forth in 
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claim 11, wherein 

in the delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value; 

said processor is set at a step execution mode 
for shifting to said processor management mode after 
executing one instruction, and 

said processor repeats the processing of the step 
execution mode until the instructions number counter 
value coincides with the largest instructions number 
counter value. 

13. The re-synchronization method as set forth in 

claim 10 , wherein 

each of all said processors received said 
interruption shifts to a processor management mode for 
re-synchronization processing in which an instructions 
number counter for counting the number of executed 
instructions in the processor fails to operate and a 
program counter value is saved and stored; 

each said processor reads the instructions number 
counter value of each processor and said saved program 
counter value and transmits the values to all other said 
computing modules; 

each said processor compares the instructions 
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number counter value with an instructions number counter 
value received from each processor in other computing 
modules; 

said computing module whose said instructions 
number counter value is not the largest executes the 
delay adjustment of executing instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value and when the 
values coincide, sends a notification to the computing 
module which includes the instructions number counter 
indicating the largest value , and 

said computing module which includes the 
instructions number counter indicating the largest value 
waits for receiving a notification from all the other 
computing modules and when receiving all the 
notifications, generates the reset signal for causing 
all the computing modules to resume operation in 
synchronization with each other. 

14. The re-synchronization method as set forth in 

claim 13 , wherein 

in delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value; 

said processor is set at a break point 
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designation execution mode for shifting to said 
processor management mode after executing up to an 
instruction at a specific position in a designated 
instruction string; 

as said specific position in the instruction 
string, an instruction position indicated by the program 
counter value received from said computing module which 
includes the instructions number counter indicating the 
largest is designated to, and 

after executing the instruction string up to said 
specific position in a designated instruction string 
said processor is shifted to the processor management 
mode. 

15. The re-synchronization method as set forth in 

claim 11 , wherein 

after reading a program execution state, said 
computing module, which includes the instructions number 
counter indicating the largest, waits for said 
notification from other computing modules; 

after executing the delay adjustment processing, 
all the other computing modules, which does not include 
the instructions number counter indicating the largest 
value, read a program execution state and transmit the 
program execution state together with a notification of 
completion of the delay adjustment processing to the 
computing module which includes the instructions number 
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counter indicating the largest , and 
15 the computing module which includes the 

instructions number counter indicating the largest 
compares program execution states of all the computing 
modules and when all coincide with each other , instructs 
on generation of the reset signal for resuming 
20 synchronization operation and when a computing module 

whose program execution state is not coincident is 
detected, instructs on the generation of the reset 
signal for resuming operation in synchronization after 
executing processing of cutting off and invalidating the 
25 computing module. 

16. A re-synchronization program for executing re- 

synchronization processing of a lock-step synchronism 
fault-tolerant computer system including a plurality of 
computing modules having a processor and a memory in 
5 which each computing module processes the same 

instruction string in clock synchronization with each 
other, comprising the functions of: 

when detecting disagreement in a state of access 
to an external bus among said processors in each said 
10 computing module, if no fault is detected in the system 

including each said computing module, generating an 
interruption to all of said processors, and 

causing each said processor to resume operation 
in synchronization after executing delay adjustment for 
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making an instruction execution state be coincident 
among said computing modules . 

17. The re-synchronization program as set forth in 
claim 16, further comprising the functions of: 

monitoring existence/non-existence of a fault in 
the system; 

monitoring a state of access of each processor in 
each said computing module to the external bus, 

when detecting disagreement in a state of access 
of each said processor in each said computing module to 
the external bus, if no fault is detected in said fault 
monitoring, generating an interruption for notifying the 
detection result to each said processor, and 

generating a reset signal for resuming operation 
in synchronization of all said computing modules after 
executing the delay adjustment for making a state of 
instruction execution be coincident among said computing 
modules . 

18. The re-synchronization program as set forth in 
claim 17, comprising: 

the function of each of all said processors 
received said interruption to shift to a processor 
management mode for re-synchronization processing in 
which an instructions number counter for counting the 
number of executed instructions in the processor fails 
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to operate; 

the function of each said processor to compare 
the read instructions number counter value with an 
instructions number counter value received from each 
processor in other computing modules; 

the function of said computing module, which does 
not include the instructions number counter indicating 
the largest value among all of the counters, to execute 
the delay adjustment of executing instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value and when the 
values coincide, to send a notification to the computing 
module which includes the instructions number counter 
indicating the largest value, and 

the function of said computing module , which 
includes the instructions number counter indicating the 
largest value, to wait for receiving a notification from 
all the other computing modules and when receiving all 
the notifications, instruct on generation of the reset 
signal for causing all the computing modules to resume 
operation in synchronization. 

19. The re-synchronization program as set forth in 

claim 18, comprising 

in the delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
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instructions number counter value coincides with the 
largest instructions number counter value; 

the function of setting said processor at a step 
execution mode for shifting to said processor management 
mode after executing one instruction; 

the function of said processor to repeat the 
processing of the step execution mode until the 
instructions number counter value coincides with the 
largest instructions number counter value. 

20. The re-synchronization program as set forth in 

claim 18, comprising: 

the function of each of all said processors 
received said interruption to shift to the processor 
management mode for re-synchronization processing in 
which an instructions number counter for counting the 
number of executed instructions in the processor fails 
to operate and a program counter value is saved and 
stored; 

the function of each said processor to read the 
instructions number counter value of each processor and 
said saved program counter value and transmit the values 
to all other said computing modules; 

the function of each said processor to compare 
the read instructions number counter value with an 
instructions number counter value received from each 
processor in other computing modules; 



the function of said computing module whose said 
instructions number counter value is not the largest to 
execute the delay adjustment of executing instructions 
until the instructions number counter value coincides 
with the largest instructions number counter value and 
when the values coincide/ to send a notification to the 
computing module which includes the instructions number 
counter indicating the largest value, and 

the function of said computing module which 
includes the instructions number counter indicating the 
largest value to wait for receiving a notification from 
all the other computing modules and when receiving all 
the notifications, instruct on generation of the reset 
signal for causing all the computing modules to resume 
operation in synchronization. 

21. The re-synchronization program as set forth in 

claim 20, comprising 

in the delay adjustment in which said computing 
module whose said instructions number counter value is 
not the largest executes instructions until the 
instructions number counter value coincides with the 
largest instructions number counter value; 

the function of setting said processor at a break 
point designation execution mode for shifting to said 
processor management mode after executing said processor 
up to an instruction at a specific position in a 
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designated instruction string; 

the function of, as said specific position in the 
instruction string, designating an instruction position 
indicated by the program counter value received from 
said computing module which includes the instructions 
number counter indicating the largest to, and 

the function of shifting said processor to the 
processor management mode after said processor executes 
the instruction string up to said specific position in a 
designated instruction string. 

22. The re-synchronization program as set forth in 

claim 20, comprising: 

the function of said computing module, which 
includes the instructions number counter indicating the 
largest, to wait for said notification from other 
computing modules after reading a program execution 
state, 

the function of all the other computing modules, 
which does not include the instructions number counter 
indicating the largest value, to read a program 
execution state and transmit the program execution state 
together with a notification of completion of the delay 
adjustment processing to the computing module which 
includes the instructions number counter indicating the 
largest after executing the delay adjustment processing, 
and 
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the function of the computing module which 
includes the instructions number counter indicating the 
largest to compare program execution states of all the 
computing modules and when all coincide with each other f 
instruct on generation of the reset signal for resuming 
operation in synchronization and when a computing module 
whose program execution state is not coincident is 
detected, instruct on the generation of the reset signal 
for resuming operation in synchronization after 
executing processing of cutting off and invalidating the 
computing module. 



